Investigation
The investigation examined LinkedIn’s processing of personal data for the purposes of behavioural analysis and targeted advertising of users who have created profiles on LinkedIn.
The supervisory authority's decisión refers to: 1. lawfulness; 2. fairness; and 3. transparency.
Findings
i. LinkedIn infringed the lawfulness of the processing:
- LinkedIn did not validly rely on consent for the processing of third-party data of its members for the purposes of behavioural analysis and targeted advertising on the basis that the consent obtained by LinkedIn was not freely given, sufficiently informed or specific or unambiguous.
- LinkedIn did not validly rely on legitimate inserests for the processing of first-party data of its members for behavioural analysis and targeted advertising purposes nor of third-party data for analytics purposes.
- LinkedIn did not validly rely on conctractual necessity to process first-party data of its members for the purpose of behavioural analysis and targeted advertising.
ii. LinkedIn contravened the principle of fairness, which requires that personal data must not be processed in a way that is detrimental, discriminatory, unexpected or misleading to the data subjects.
iii. LinkedIn failed to ensure that data subjects were fully informed of the scope and consequences of the processing of their personal data.
Outcome
The supervisory authority's decision exercised the following corrective powers:
i. A reprimand.
ii. Three administrative fines for a total of €310 million.
iii. An order for LinkedIn to bring its processing into compliance.